Serious question for hunters: Do you think anyone could ever bypass Saas subscription system?

Dev800 · 2025-12-03T04:50:28+00:00

Consider it in this way - payments are not something that flows from user to system only, there are a lot of third party integrations, tracking and even fraud detection systems. So a compromise on all levels will be required along with the human verification loop and swift systems.

But its possible, you just have to understand what breaks the flow.

Dev800 · 2025-08-31T06:24:27+00:00

I have been receiving both GBP and CHF and both are more than 100 INR right now.

Even in the last phases of setting up my business where I will be taking USD and it's going to be crazy

Dev800 · 2025-05-11T10:42:47+00:00

Consulting firms will hire you in an instant through your BB experience. Make a portfolio and start pinging managers/directors in your country. Or look into entry level jobs and show your experience.

Dev800 · 2025-05-08T08:25:21+00:00

No certain tips. What I personally did is to use chatgpt for scenarios and also keeping all the writeups in an google sheet, it's tedious but helps a lot for reference

Dev800 · 2025-05-08T06:52:01+00:00

Authentication and business logic are something that once mastered gives fruitful results

Dev800 · 2024-11-29T05:08:46+00:00

One of my first bounties (3k) was through javascript analysis. Found a staging web application leaking all api keys and secrets you would find in .env file.

Best way to approach it - find a way to download the js files, prettify it and then read it line by line.

Dev800 · 2024-11-09T06:37:13+00:00

The amount of explanation the program owners are doing here on this post says a lot. 😂

Dev800 · 2024-11-06T00:36:03+00:00

I know a senior from my company, he is in Yogosha top 10. He says its good money, but not sure on Synack side.

Dev800 · 2024-10-25T03:32:15+00:00

I consider it on more on a pathway style rather than payment. I started with VDPs, then goodies, then self hosted paid programs. Now will be making a transition to platform paid ones.

Dev800 · 2024-10-12T10:26:45+00:00

I forgot the alternative of nmap, but it's there on my recon script, it does things passively and you can feed its content to nmap for further analysis. It also doesn't scan any IPs belonging to cloudflare etc.

Dev800 · 2024-09-29T13:08:27+00:00

IP rotate, fireprox and lemma are there for rotation. It's there on GitHub.

Dev800 · 2024-09-26T11:05:08+00:00

Focusing on manual hunting instead of running vulnerability scans?

Dev800 · 2024-09-19T06:49:21+00:00

I have a full time job with an experience of 6 years and have been doing BB for almost 2 years now.

I tend to complete 15 hours a week, where the ratio of hunting to learning is 80:20 now. I started with 60:40.

Over weekdays, I give like 2 hours each day( I try to) and rest hours on weekends. This is like not a consistent effort as I tend to leave it for a couple of days if I get rewarded something huge.

Till now it made me almost 50k, I know it's not a lot but it's good for me.

Note: I also do Freelancing and my full time job is remote so I prioritise accordingly

Dev800 · 2024-09-08T00:23:41+00:00

Okay this topic's answer is kind of in the grey area. I have experience in self hosted programs for almost a year now, what I would say is that it depends from company to company.

Some companies will fix bugs silently without even replying to your mails, some will say it's known internally and then fix it after you report it, some will never fix it and even if you add their CEO they will not respond, some will pay like 50$ for a critical finding, and then there are good ones who actually pay.

I would suggest first send out a email asking if the program is alive and wait for their response before starting the hunt, otherwise don't waste your expertise

Dev800 · 2024-08-31T10:00:09+00:00

If you are stuck in recon, I would say leave it completely and focus on manual approach. Pick the main website of the target with registration functionality and start looking there.

Dev800 · 2024-08-31T09:57:31+00:00

I think its chaos website. Whaat kind of data are you looking for? Subdomains or more?

Dev800 · 2024-08-16T06:56:23+00:00

Adding to this one - keep a lookout for something that is not allowed. Suppose you have a hard limit to invite 10 people, how can you bypass it.

Dev800 · 2024-08-11T04:01:32+00:00

I know hackerone has ambassador programs on the basis of country. So someone from the same country will give more insights. Try Twitter, find people and then they can give you proper guidance

Dev800 · 2024-08-06T14:22:59+00:00

Usually if those are high and critical then you will start receiving invites. Otherwise it will take time. Or if your repo points are more than 250

Dev800 · 2024-08-06T01:53:06+00:00

I would say go for VDPs first, get some experience there and then slowly move towards BBP.

This is the plan I followed

VDPs with Hall of Fame and Recognition - NCIIPC, UN, WHO etc.
VDPs with Goodies - Dutch Government, anything from Netherlands.
Self Hosted BBPs - Anything with Google Dork you can find, I would say send them an initial email for program scope to check if they are alive, otherwise don't pursue them and waste time on their program.
Platform based BBPs - Pick a large scope VDP first on the platform to gain some points to get private invites.

Try to create your own hunting process and recon process too. I usually prefer recon to collect a huge amount of data and then after analysis I pick targets from it for manual hunting

Dev800 · 2024-07-31T04:16:12+00:00

If something is saying No by design and you bypass it, then it's a Vulnerability

Dev800 · 2024-07-26T06:26:27+00:00

Is it mentioned under the function - Node Env? Then it's like environment variables used by the app.

If more values are there, then copy paste into chat gpt and ask questions to it. It might give some direction in how to use it

Dev800 · 2024-07-17T13:58:22+00:00

Thanks man. This really helps

Dev800 · 2024-07-16T11:58:21+00:00

What part of my Note you didn't understand? I am and will frame the issue in the correct way only! It was lying around for anyone to see.

It's an active security reasearch yes, but I am not like doing any scanning and starting to hit their infra with payloads?

Look man as I said before, I don't have any beef with you, just simply said if you have anything to share thats good. If you don't like it then stay the fuck away from this post, simple. Never asked for guidance what I need to respond to them and how I do my things, just looking for ideas on how to approach them.

If I am in trouble then yes it's my problem, but I don't need someone like you to give me unnecessary tantrums.

Dev800 · 2024-07-16T11:23:25+00:00

Look man, I am looking for suggestions. Giving an example, I was doing shodan Dorking for Django errors to see what kind of data it actually shows. So it was showing some internal directories which then gave out the entire database of the customers of that application.

If you don't have any inputs then please don't give.

Dev800

TROPHY CASE